nv-l
[Top] [All Lists]

Re: [NV-L] Ruleset Editing Questions

To: Tivoli NetView Discussions <nv-l@lists.ca.ibm.com>
Subject: Re: [NV-L] Ruleset Editing Questions
From: James Shanks <jshanks@us.ibm.com>
Date: Tue, 24 Oct 2006 09:16:15 -0400
Delivery-date: Tue, 24 Oct 2006 14:32:28 +0100
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <OFC3525686.47B1908C-ON85257211.00417588-85257211.00433126@cantire.com>
List-help: <mailto:nv-l-request@lists.ca.ibm.com?subject=help>
List-id: Tivoli NetView Discussions <nv-l.lists.ca.ibm.com>
List-post: <mailto:nv-l@lists.ca.ibm.com>
List-subscribe: <http://lists.ca.ibm.com/mailman/listinfo/nv-l>, <mailto:nv-l-request@lists.ca.ibm.com?subject=subscribe>
List-unsubscribe: <http://lists.ca.ibm.com/mailman/listinfo/nv-l>, <mailto:nv-l-request@lists.ca.ibm.com?subject=unsubscribe>
Reply-to: Tivoli NetView Discussions <nv-l@lists.ca.ibm.com>
Sender: nv-l-bounces@lists.ca.ibm.com

If you use xnmtrap and set the trap to "Log Only" It will not be sent to TEC nor display in your event windows but it will be kept in trapd.log so that you can gauge how many you are getting. You can also set the trapd to "Don't Log or Display" and this will keep it from the log as well, but then you'll have no way of knowing what's going on if start having a performance problem because too many of these traps are arriving.

Cisco devices are highly configurable. You usually can configure just the traps you want and even the frequency that they are sent. Perhaps you should talk to your network guys about that and solve the problem at the source. Remember that getting a lot of unwanted traps isn't just a nuisance. It's a performance issue, not just for NetView, but for everyone else on the same subnet. That's their potential bandwidth you are eating and throwing away.

As for your ruleset, I'm not sure what it is supposed to say. Greater than or less than the OID? Why not just "not equal to" ?

But in any case you can tell exactly what ruleset you are running in two ways. If you are keeping an nvserverd.log, then the name will be in there, as will evidence of the reload. But whether you are or are not keeping the nvserverd.log, you can issue "nvcdebug -n" which will cause nvcorrd to write out in detail to his log what rulesets he is running. You can see the contents of the ruleset there. You can also debug this way by sending "nvcdebug -d all" and then observing what happens to each event as it is evaluated. Everything between the eyecatcher "Received a trap" and "Finished with the event" is nvcorrd processing that event.

James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Network Availability Management
Network Management - Development
Tivoli Software, IBM Corp
Inactive hide details for sean.lawrence@cantire.comsean.lawrence@cantire.com


          sean.lawrence@cantire.com
          Sent by: nv-l-bounces@lists.ca.ibm.com

          10/24/2006 08:13 AM
          Please respond to
          Tivoli NetView Discussions <nv-l@lists.ca.ibm.com>


To

Tivoli NetView Discussions <nv-l@lists.ca.ibm.com>

cc


Subject

[NV-L] Ruleset Editing Questions

I am trying to set up some rules to filter out traps coming for
Ciscoworks. We are getting way to many now that the network guys have
turned it on.

Is there a way to simply drop traps that have not been defined in the
trapd.conf? I do not want to keep them in Netview or forward them to TEC.

On a side note I am having trouble setting up simple rules.

I am receiving a trap from Ciscoworks with the OID of 1.3.6.1.4.1.9.1.502
I do not want this forwarded to TEC

In the ruleset defined in tecint.conf I created an Event Attributes rule.
It looks like this:

Event Stream -> (EnterpriseOID <>  1.3.6.1.4.1.9.1.502) -> Forward

I ran the nvtecia -reload command to reload the ruleset and I am still
getting these forwarded. Is there something else required to load modified
rulesets?

Sean
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to internal IBM'ers only)

GIF image

_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to 
internal IBM'ers only)
<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web